Detecting and Mitigating IFEO Injection (T1546.012)

Image File Execution Options (IFEO) injection (MITRE ATT&CK T1546.012) is a Windows persistence and privilege escalation technique. IFEOs let a developer attach a debugger to an application. When a process is created, a debugger set in the application's IFEO entry is placed in front of the program name, so the new process starts under that debugger. MITRE's example is C:\dbg\ntsd.exe -g notepad.exe.

How attackers use it

IFEOs can be set straight in the registry or with Global Flags, through the GFlags tool. They are stored as Debugger values under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options, in a subkey named for the program the debugger is attached to. The same path exists under Wow6432Node for 32-bit programs.

MITRE describes several abuse paths:

• Silent exit monitoring. An IFEO can also launch a monitor program when a chosen program silently exits, which means it ends early on its own or through a non-kernel-mode process. Like debuggers, this can be turned on through GFlags or by editing IFEO and silent process exit values under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\.
• Accessibility programs. As with Accessibility Features (T1546.008), on Windows Vista and later, and Windows Server 2008 and later, a registry key can set cmd.exe or another backdoor program as the debugger for an accessibility program such as utilman.exe. The key combination at the login screen, at the keyboard or over Remote Desktop Protocol, then runs the debugger with SYSTEM privileges.
• Privilege escalation. As with Process Injection, the values can cause a malicious executable to be loaded and run in the context of other processes. Installing IFEO mechanisms also provides persistence through continuous triggered invocation.
• Impairing defenses. Malware may register invalid debuggers that redirect and effectively disable system and security applications.

That last point makes IFEO relevant even where persistence is not the goal. A security tool that quietly stops starting can be an IFEO problem.

How to detect it

MITRE's strategy links registry edits to process behavior:

• Registry changes under the IFEO paths, particularly a Debugger value, especially for security related or accessibility binaries.
• Process execution with debugger flags, or SYSTEM level access at login.
• Process creation and parent and child anomalies, unusual command lines or access tokens.

Sysmon registry events (IDs 12, 13 and 14) cover the writes. For the impair defenses case, alert when a security product's executable name appears as an IFEO key.

How to reduce the risk

MITRE lists no mitigations for this sub-technique. Steps that follow from the mechanism:

1. Limit who can write to HKLM, since these keys need administrative rights.
2. Apply the Accessibility Features mitigations: Network Level Authentication, a Remote Desktop Gateway and application control.
3. Keep a baseline of legitimate Debugger values on your standard builds, which is often an empty set.
4. Alert on any new key under Image File Execution Options and SilentProcessExit.

Check your own environment

Read-only commands in a Windows command prompt:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /v Debugger
reg query "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s /v Debugger
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit" /s

A clean system usually returns no Debugger values from the first two commands. Then check:

1. Does any Debugger value point at cmd.exe, a script host or a file in a user writable path?
2. Is any security tool's executable listed as a key?
3. Are there SilentProcessExit entries you cannot explain?
4. Are registry changes under these paths logged and reviewed?

Quick check

Sources

• MITRE ATT&CK T1546.012, Event Triggered Execution: Image File Execution Options Injection